DevStation CLI

Permissions & Sandbox

The agent does ordinary development without interrupting you, asks before anything risky, and runs its shell commands in a container that cannot reach the rest of your machine.

What it asks permission for

Reading, searching, editing files and running the tests happen without asking. A tool that interrupts you for ordinary work gets its prompts clicked through without being read, which is worse than not asking.

It asks before anything that loses data, spends money, changes who can get in, or reaches production. It shows the exact command and asks you to choose, with the arrow keys and Enter, or by pressing the number or letter beside an answer. Esc means no.

Answer	Means
1 · Yes, proceed (y)	Allow it once.
2 · Yes, and don't ask again this session (a)	Allow that action, on that target, for the rest of the session.
3 · No, skip it (n), or Esc	No. The agent carries on without it.

“Always” is remembered per action and what it touches, so saying it to ls does not approve npm install. Chains of read-only commands such as ls -a; cat package.json | grep version do not ask at all.

Autonomy levels

--autonomy moves the line between what proceeds and what asks. There is a floor it cannot move.

Mode	What proceeds unattended
ask_sensitive (default)	Ordinary development only. Everything gated asks.
ask_integrations	Ordinary work, plus medium-risk integration work: adding a dependency, writing config, creating a repository.
ask_deploy	Everything except deploys and anything critical.
autonomous	Everything except critical.

Critical always asks

Deleting a project, reading stored credentials, running an arbitrary shell command and rewinding git history always ask, whatever the setting. -y and /approve approve gated actions; they do not lower that floor.

Two things it cannot do at all: push, and open a pull request. It proposes; you decide, with the diff in front of you. devstation tools prints every tool and which side of the line it falls on, for the settings you would actually run with.

The sandbox

Shell commands run inside a container, not directly on your machine. It is on by default.

The workspace is mounted and writable. The rest of your machine is not reachable from inside.
The container has internet access, so the agent can install packages, clone repositories and run builds.
Files it writes come out owned by you, not by root.

Set it up

It needs Docker and, by default, gVisor (runsc) as the runtime, which puts a user-space kernel between the container and your machine. Build the image once:

bash

bun run sandbox:image        # docker build -t devstation-sandbox:1 -f docker/sandbox.Dockerfile docker

If Docker, the runtime or the image is missing, the CLI refuses to start and names the fix, rather than quietly running your commands unsandboxed.

Variations

bash

DEVSTATION_SANDBOX_NETWORK=off devstation     # no internet inside the container
DEVSTATION_SANDBOX_RUNTIME=runc devstation    # weaker isolation, where gVisor is unavailable
DEVSTATION_SANDBOX_IMAGE=my-image devstation  # an image with extra toolchains
devstation --no-sandbox                       # run commands on this machine (DEVSTATION_SANDBOX=off)

The banner always says which you got: the runtime, the user, and whether the container has internet access.

Running on the machine instead

Inside the container, this machine's logins are not available: the GitHub CLI, git credentials and cloud CLIs belong to your account on the machine, not to the sandbox. When the agent needs them, run it on the machine itself, and save the choice so it sticks:

bash

devstation config set sandbox off     # every session on this machine
devstation config set sandbox off --project   # just this project
devstation config set sandbox on      # back to the container

--sandbox, --no-sandbox and DEVSTATION_SANDBOX still override the saved choice for a single run.

Background commands

Anything that keeps running, such as a dev server, a local chain like anvil, or a watcher, is started in the background. The agent reads what it has printed with shell_output and stops it with stop_shell, and every background command ends when the session does. This works on the machine and inside the sandbox.

The web

Two tools, no key needed:

web_search searches the web and returns titles, links and snippets.
fetch_url reads one page, a README or an API reference as text.

The agent uses them when a question needs current information, instead of answering from memory. Private network addresses are refused, and everything fetched is treated as data, never as instructions.